Tenant isolation belongs in middleware, not in your handlers

If every route has to remember the tenant check, one of them eventually will not.